#T1547.001

• 2026-09-22 23:09 UTC Cortex XDR : Spot persistence attempts by monitoring reg.exe command-line executions adding auto-start entries under Windows Run or RunOnce registry keys.

  #alerts#detection#multi-tenant#xql#T1547.001